Re: [Ideas] Comments on draft-ccm-ideas-identity-use-cases-02

[Tom Herbert <[e-mail]>]

On Wed, Oct 18, 2017 at 9:44 AM, Uma Chunduri <[e-mail]> wrote:
> Tom,
>
>
>         >Google Cloud for instance operates a huge multi-tenant network and I suspect they use LOAS to authenticate access to
>
> Context here is not where to deploy this but how to make a mapping system where it's applicable for multiple environments (enterprise, DC,  etc..)   with flexibility to work with existing ID/LOC protocols.
>
>         >In my design for ILA, I'm fond of using TLS for communications which provides both security (encryption) and verifiable identity in certificates. The X.509 identity can be used to against ACLs to control read and write access.
>
> Couple of things:
> 1. ILA is one of the data planes and lot of issues you raised in this thread applicable there too, IMO. What we thoroughly looked into were the existing IETF approved ID/LOC technologies (HIP & LISP), where there are multiple  immediate use cases

The deployment of HIP and LISP pale in comparison to the deployed uses
of VXLAN, nvgre, ILA, and a few hacked up internal protocols that do
identifier-locator. If I wanted to build something practical and that
scales I'd be more inclined to look at what is being used and what
lessons can be learned.

> 2. I would note -  DC/VM with multi-tenant mobility is only one of the use cases for IDEAS - and AFAIK you contributed a lot from ILA pov.

To be clear, ILA is suitable for both the DC _and_ public wireless
network use cases. We are designing and implementing both for both use
cases.

> 3. On using TLS/X.509  - we are jumping way ahead of ourselves - we can come back on this if we have *a wg*

Sure, but my point is that people may have already have a solution for
this part of the problem. To say that mapping systems today have no
solution to security doesn't seem not correct. As we learned well in
nvo3, the industry doesn't wait for IETF!

> 4. The above also depends on the type of the device in question too (for low power devices #3 may not be applicable).

IMO its unlikely that low powered or end devices would directly access
the mapping system. In both the design for DC and  (likely design) for
wireless mobile networks the infrastructure uses identifier-locator to
implement an overlay network. In the DC case this is consistent with
the nvo3 architecture (i.e. identifier-locator is transparent to VMs).
In the same manner, the mobility in the mobile networks can be
implemented in the infrastructure. This is where some reference
network architecture on what actual and practical deployment would
look like helps.